{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-120737","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-11-02T20:38:39.339Z","datePublished":"2026-11-07T02:29:13.365Z","dateUpdated":"2026-11-07T02:29:13.365Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-11-07T02:29:13.365Z"},"affected":[{"vendor":"artbees","product":"Jupiter X Core","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.62.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier."}],"title":"Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32199349-f7ae-4ed3-ae2b-29e80c08c9d2?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L96"},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/module.php#L103"},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/widgets/posts.php#L259"},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/advanced-posts/functionality/frontend.php#L236"},{"url":"https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.62.0/includes/extensions/raven/includes/modules/posts/module.php#L56"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-862 Missing Authorization","cweId":"CWE-862","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM"}}],"credits":[{"lang":"en","type":"finder","value":"hoho087"}],"timeline":[{"time":"2026-11-02T20:54:17.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-11-06T14:01:19.000Z","lang":"en","value":"Disclosed"}]}}}